Skip to content

Commit 344f709

Browse files
v-ccolinv-ccolin
authored
Merge pull request #246945 from AlizaBernstein/WI-142278-malware-scanning-ga-docs-part1
WI-142278-malware-scanning-ga-docs-part1
2 parents c21d6e2 + 70a4204 commit 344f709

22 files changed

+848
-264
lines changed

‎articles/defender-for-cloud/TOC.yml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -674,14 +674,24 @@
674674
items:
675675
- name: Protect your storage with Defender for Storage
676676
href: tutorial-enable-storage-plan.md
677-
- name: Additional configurations for Defender for Storage
678-
href: ../storage/common/azure-defender-storage-configure.md?toc=/azure/defender-for-cloud/toc.json
679677
- name: Required permissions
680678
href: support-matrix-defender-for-storage.md
681-
- name: Setting up response to Malware Scanning
679+
- name: Enable Defender for Storage
680+
items:
681+
- name: Enable with the Azure policy (recommended)
682+
href: defender-for-storage-policy-enablement.md
683+
- name: Enable with Infrastructure as Code
684+
href: defender-for-storage-infrastructure-as-code-enablement.md
685+
- name: Enable with REST API
686+
href: defender-for-storage-rest-api-enablement.md
687+
- name: Enable with the Azure portal
688+
href: defender-for-storage-azure-portal-enablement.md
689+
- name: Advanced configurations for malware scanning
690+
href: advanced-configurations-for-malware-scanning.md
691+
- name: Setup response to malware scanning
682692
href: defender-for-storage-configure-malware-scan.md
683-
- name: Test and run a Proof of Concept
684-
href: defender-for-storage-test.md
693+
- name: Test and run a proof of concept
694+
href: defender-for-storage-test.md
685695
- name: List of security threats and security alerts
686696
href: defender-for-storage-threats-alerts.md
687697
- name: Common questions about Defender for Storage

‎articles/defender-for-cloud/advanced-configurations-for-malware-scanning.md

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
---
2+
title: Microsoft Defender for Storage - advanced configurations for malware scanning
3+
description: Learn about the advanced configurations of Microsoft Defender for Storage malware scanning
4+
ms.date: 08/08/2023
5+
author: dcurwin
6+
ms.author: dacurwin
7+
ms.topic: conceptual
8+
---
9+
10+
# Advanced configurations for malware scanning
11+
12+
Malware Scanning can be configured to send scanning results to the following:
13+
14+
- **Event Grid custom topic** - for near-real time automatic response based on every scanning result.
15+
- **Log Analytics workspace** - for storing every scan result in a centralized log repository for compliance and audit.
16+
17+
Learn more on how to [set up response for malware scanning](/azure/defender-for-cloud/defender-for-storage-configure-malware-scan) results.
18+
19+
> [!TIP]
20+
> We recommend you try the [Ninja training instructions](https://github.com/Azure/Microsoft-Defender-for-Cloud/blob/main/Labs/Modules/Module%2019%20-%20Defender%20for%20Storage.md), a hands-on lab, to try out malware scanning in Defender for Storage, using detailed step-by-step instructions on how to test malware scanning end-to-end with setting up responses to scanning results. This is part of the 'labs' project that helps customers get ramped up with Microsoft Defender for Cloud and provides hands-on practical experience with its capabilities.
21+
22+
## Setting up logging for malware scanning
23+
24+
For each storage account enabled with malware scanning, you can define a Log Analytics workspace destination to store every scan result in a centralized log repository that is easy to query.
25+
26+
:::image type="content" source="media/azure-defender-storage-configure/log-analytics-settings.png" alt-text="Screenshot showing where to configure a Log Analytics destination for scan log." lightbox="media/azure-defender-storage-configure/log-analytics-settings.png":::
27+
28+
Before sending scan results to Log Analytics, [create a Log Analytics workspace](/azure/azure-monitor/logs/quick-create-workspace) or use an existing one.
29+
30+
To configure the Log Analytics destination, navigate to the relevant storage account, open the **Microsoft Defender for Cloud** tab, and select the settings to configure.
31+
32+
This configuration can be performed using REST API as well:
33+
34+
Request URL:
35+
36+
```
37+
PUT
38+
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Storage/storageAccounts/{accountName}/providers/Microsoft.Security/DefenderForStorageSettings/current/providers/Microsoft.Insights/diagnosticSettings/service?api-version=2021-05-01-preview
39+
```
40+
Request Body:
41+
42+
```
43+
{
44+
"properties": {
45+
"workspaceId": "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{workspaceName}",
46+
"logs": [
47+
{
48+
"category": "ScanResults",
49+
"enabled": true,
50+
"retentionPolicy": {
51+
"enabled": true,
52+
"days": 180
53+
}
54+
}
55+
]
56+
}
57+
}
58+
```
59+
60+
## Setting up Event Grid for malware scanning
61+
62+
For each storage account enabled with malware scanning, you can configure to send every scan result using an Event Grid event for automation purposes.
63+
64+
1. To configure Event Grid for sending scan results, you'll first need to create a custom topic in advance. Refer to the Event Grid documentation on creating custom topics for guidance. Ensure that the destination Event Grid custom topic is created in the same region as the storage account from which you want to send scan results.
65+
66+
1. To configure the Event Grid custom topic destination, go to the relevant storage account, open the **Microsoft Defender for Cloud** tab, and select the settings to configure.
67+
68+
> [!NOTE]
69+
> When you set an Event Grid custom topic, you should set **Override Defender for Storage subscription-level settings” to **On** to make sure it overrides the subscription-level settings.
70+
71+
:::image type="content" source="media/azure-defender-storage-configure/event-grid-settings.png" alt-text="Screenshot that shows where to enable an Event Grid destination for scan logs." lightbox="media/azure-defender-storage-configure/event-grid-settings.png":::
72+
73+
This configuration can be performed using REST API as well:
74+
75+
Request URL:
76+
77+
```
78+
PUT
79+
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Storage/storageAccounts/{accountName}/providers/Microsoft.Security/DefenderForStorageSettings/current?api-version=2022-12-01-preview
80+
```
81+
82+
Request Body:
83+
84+
```
85+
{
86+
"properties": {
87+
"isEnabled": true,
88+
"malwareScanning": {
89+
"onUpload": {
90+
"isEnabled": true,
91+
"capGBPerMonth": 5000
92+
},
93+
"scanResultsEventGridTopicResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.EventGrid/topics/{EventGridTopicName}"
94+
},
95+
"sensitiveDataDiscovery": {
96+
"isEnabled": true
97+
},
98+
"overrideSubscriptionLevelSettings": true
99+
}
100+
}
101+
```
102+
## Override Defender for Storage subscription-level settings
103+
104+
The subscription-level settings inherit Defender for Storage settings on each storage account in the subscription. Use Override Defender for Storage subscription-level settings to configure settings for individual storage accounts different from those configured on the subscription level.
105+
106+
Overriding the settings of the subscriptions are usually used for the following scenarios:
107+
108+
- Enable/disable the Malware Scanning or the Data sensitivity threat detection features.
109+
- Configure custom settings for Malware Scanning.
110+
- Disable Microsoft Defender for Storage on specific storage accounts.
111+
112+
> [!NOTE]
113+
> We recommend that you enable Defender for Storage on the entire subscription to protect all existing and future storage accounts in it. However, there are some cases where you would want to exclude specific storage accounts from Defender protection. If you've decided to exclude, follow the steps below to use the override setting and then disable the relevant storage account. If you are using Defender for Storage (classic), you can also [exclude storage accounts](defender-for-storage-classic-enable.md).
114+
115+
### Azure portal
116+
117+
To configure the settings of individual storage accounts different from those configured on the subscription level using the Azure portal:
118+
119+
1. Sign in to the Azure portal.
120+
121+
1. Navigate to your storage account that you want to configure custom settings.
122+
123+
1. In the storage account menu, in the **Security + networking** section, select **Microsoft Defender for Cloud**.
124+
125+
1. Select **Settings** in Microsoft Defender for Storage.
126+
127+
1. Set the status of **Override Defender for Storage subscription-level settings** (under Advanced settings) to **On**. This ensures that the settings are saved only for this storage account and will not be overrun by the subscription settings.
128+
129+
1. Configure the settings you want to change:
130+
131+
1. To enable malware scanning or sensitive data threat detection, set the status to **On**.
132+
133+
1. To modify the settings of malware scanning:
134+
135+
1. Switch the **On-upload malware scanning** to **On** if it’s not already enabled.
136+
137+
1. To adjust the monthly threshold for malware scanning in your storage accounts, you can modify the parameter called **Set limit of GB scanned per month** to your desired value. This parameter determines the maximum amount of data that can be scanned for malware each month, specifically for each storage account. If you wish to allow unlimited scanning, you can uncheck this parameter. By default, the limit is set at 5,000 GB.
138+
139+
140+
1. To disable Defender for Storage on this storage account, set the status of Microsoft Defender for Storage to **Off**.
141+
142+
:::image type="content" source="media/azure-defender-storage-configure/defender-for-storage-settings.png" alt-text="Screenshot that shows where to turn off Defender for Storage in the Azure portal." lightbox="media/azure-defender-storage-configure/defender-for-storage-settings.png":::
143+
144+
Select **Save**.
145+
146+
### REST API
147+
148+
To configure the settings of individual storage accounts different from those configured on the subscription level using REST API:
149+
150+
Create a PUT request with this endpoint. Replace the subscriptionId, resourceGroupName, and accountName in the endpoint URL with your own Azure subscription ID, resource group and storage account names accordingly.
151+
152+
Request URL:
153+
154+
```
155+
PUT
156+
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/providers/Microsoft.Security/DefenderForStorageSettings/current?api-version=2022-12-01-preview
157+
```
158+
159+
Request Body:
160+
161+
```
162+
{
163+
"properties": {
164+
"isEnabled": true,
165+
"malwareScanning": {
166+
"onUpload": {
167+
"isEnabled": true,
168+
"capGBPerMonth": 5000
169+
}
170+
},
171+
"sensitiveDataDiscovery": {
172+
"isEnabled": true
173+
},
174+
"overrideSubscriptionLevelSettings": true
175+
}
176+
}
177+
```
178+
179+
1. To enable malware scanning or sensitive data threat detection, set the value of isEnabled to **true** under the relevant features.
180+
181+
1. To modify the settings of malware scanning, edit the relevant fields under onUpload, make sure the value of isEnabled is **true**. If you want to permit unlimited scanning, assign the value -1 to the capGBPerMonth parameter.
182+
183+
1. To disable Defender for Storage on this storage accounts, use the following request body:
184+
185+
```
186+
{
187+
"properties": {
188+
"isEnabled": false,
189+
"overrideSubscriptionLevelSettings": true
190+
}
191+
}
192+
```
193+
194+
Make sure you add the parameter `overrideSubscriptionLevelSettings` and its value is set to **true**. This ensures that the settings are saved only for this storage account and will not be overrun by the subscription settings.
195+
196+
## Next steps
197+
198+
Learn more about [malware scanning settings](defender-for-storage-malware-scan.md).

‎articles/defender-for-cloud/defender-for-storage-azure-portal-enablement.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: Enable and configure the Defender for Storage plan at scale using the Azure portal
3+
description: Learn how to enable the Defender for Storage on your Azure subscription for Microsoft Defender for Cloud using the Azure portal.
4+
ms.topic: install-set-up-deploy
5+
author: AlizaBernstein
6+
ms.author: v-bernsteina
7+
ms.date: 08/15/2023
8+
---
9+
10+
# Enable and configure with the Azure portal
11+
12+
We recommend that you enable Defender for Storage on the subscription level. Doing so ensures all current and future storage accounts in the subscription are protected.
13+
14+
> [!TIP]
15+
> You can always [configure specific storage accounts](/azure/storage/common/azure-defender-storage-configure?toc=%2Fazure%2Fdefender-for-cloud%2Ftoc.json&tabs=enable-subscription#override-defender-for-storage-subscription-level-settings) with custom configurations that differ from the settings configured at the subscription level (override subscription-level settings).
16+
17+
## [Enable on a subscription (recommended)](#tab/enable-subscription/)
18+
19+
To enable Defender for Storage at the subscription level using the Azure portal:
20+
21+
1. Sign in to the Azure portal.
22+
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
23+
1. Select the subscription for which you want to enable Defender for Storage.
24+
25+
:::image type="content" source="media/defender-for-storage-malware-scan/azure-portal-enablement-subscription.png" alt-text="Screenshot that shows where to select the subscription." lightbox="media/defender-for-storage-malware-scan/azure-portal-enablement-subscription.png":::
26+
27+
1. On the Defender plans page, locate **Storage** in the list and select **On** and **Save**. If you currently have Defender for Storage enabled with per-transaction pricing, select the **New pricing plan available** link and confirm the pricing change.
28+
29+
:::image type="content" source="media/defender-for-storage-malware-scan/azure-portal-enablement-turn-on.png" alt-text="Screenshot that shows where to turn on Storage plan." lightbox="media/defender-for-storage-malware-scan/azure-portal-enablement-turn-on.png":::
30+
31+
Microsoft Defender for Storage is now enabled for this subscription, and is fully protected, including on-upload malware scanning and sensitive data threat detection.
32+
33+
If you want to turn off the on-upload malware scanning or sensitive data threat detection, you can select **Settings** and change the status of the relevant feature to **Off** and save the changes.
34+
35+
If you want to change the malware scanning size capping per storage account per month for malware, change the settings in **Edit configuration** and save the changes.
36+
37+
If you want to disable the plan, turn status button to **Off** for the Storage plan on the Defender plans page and save the changes.
38+
39+
## [Enable on a storage account](#tab/enable-storage-account/)
40+
41+
To enable and configure Microsoft Defender for Storage for a specific account using the Azure portal:
42+
43+
1. Sign in to the Azure portal.
44+
1. Navigate to your storage account.
45+
In the storage account menu, in the **Security + networking** section, select **Microsoft Defender for Cloud**.
46+
1. On-upload Malware Scanning and Sensitive data threat detection are enabled by default. You can disable the features by unselecting them.
47+
1. Select  **Enable on storage account**. Microsoft Defender for Storage is now enabled on this storage account.
48+
49+
:::image type="content" source="media/defender-for-storage-malware-scan/azure-portal-enablement-on-storage-account.png" alt-text="Screenshot that shows where to enable the storage account." lightbox="media/defender-for-storage-malware-scan/azure-portal-enablement-on-storage-account.png":::
50+
51+
> [!TIP]
52+
> To configure On-upload malware scanning settings, such as monthly capping, select Settings after Defender for Storage was enabled.
53+
54+
If you want to disable Defender for Storage on the storage account or disable one of the features (on-upload malware scanning or Sensitive data threat detection), select **Settings**, edit the settings, and select **Save**.
55+
56+
---
57+
58+
> [!TIP]
59+
> Malware Scanning can be configured to send scanning results to the following: <br> **Event Grid custom topic** - for near-real time automatic response based on every scanning result. Learn more how to [configure malware scanning to send scanning events to an Event Grid custom topic](/azure/storage/common/azure-defender-storage-configure?toc=%2Fazure%2Fdefender-for-cloud%2Ftoc.json&tabs=enable-storage-account#setting-up-event-grid-for-malware-scanning). <br> **Log Analytics workspace** - for storing every scan result in a centralized log repository for compliance and audit. Learn more how to [configure malware scanning to send scanning results to a Log Analytics workspace](/azure/storage/common/azure-defender-storage-configure?toc=%2Fazure%2Fdefender-for-cloud%2Ftoc.json&tabs=enable-storage-account#setting-up-logging-for-malware-scanning).
60+
61+
## Next steps
62+
63+
- Learn how to [enable and Configure the Defender for Storage plan at scale with an Azure built-in policy](defender-for-storage-policy-enablement.md).
64+
- Learn more on how to [set up response for malware scanning](defender-for-storage-configure-malware-scan.md) results.

0 commit comments

Comments
 (0)